Data control for zero-trust security container

1 . A computer-implemented method for zero-trust security container data control, comprising:

generating a zero-trust security policy based on a scenario; building a data pool for a zero-trust security container;

adopting the zero-trust security policy for data to be admitted to or egressed from the data pool and while within the data pool, wherein admission or egress is allowed for the data to be in or out of the data pool only after the data is verified based on the zero-trust security policy; and

hierarchically isolating data in the data pool based on the zero-trust security policy and so that the data in the data pool can be read directionally, wherein isolating the data in the data pool includes limiting upper limits of resources that can be used by a process group, and wherein course-grained and fine-grained control is performed on the data in the data pool from different dimensions comprising one or more of a data source, a role of a data writing party, and a role of a data reading party,

wherein at a coarse-grained level, access control is performed on a data stream between servers,

wherein at a fine-grained level, data access is restricted based on one or more of a role, an identity, or a source, and

wherein each piece of data in the data pool has a role label and a source label, and data with different role labels and source labels are mutually isolated.

2 . The computer-implemented method of claim 1 , wherein the zero-trust security policy comprises trusting none of data reading/writing parties.

3 . The computer-implemented method of claim 2 , wherein the zero-trust security policy comprises:

verifying a source for data to be written to the data pool; and

admitting, as admitted data, data whose source is verified, wherein the admitted data is labeled with a source label.

4 . The computer-implemented method of claim 2 , wherein the zero-trust security policy comprises:

verifying a source and a role of a data writing party for data to be written to the data pool; and

admitting, as admitted data, data whose source and role of a data writing party are verified, wherein the admitted data is labeled with a source label and a role label of the data writing party.

5 . The computer-implemented method of claim 3 , wherein the zero-trust security policy comprises:

verifying, for data to be read from the data pool, a source, a role of a data writing party, and a role of a data reading party that are provided by the data reading party; and

egressing data whose source, role of a data writing party, and role of a data reading party are verified.

6 . The computer-implemented method of claim 1 , wherein the hierarchically isolating data in the data pool based on the zero-trust security policy comprises isolating the data pool into multiple data domains.

7 . The computer-implemented method of claim 6 , wherein isolating the data pool into multiple data domains comprises isolating the data into the multiple data domains by sensitive data and runtime data.

8 . The computer-implemented method of claim 6 , wherein isolating the data pool into multiple data domains comprises isolating the data into the multiple data domains by source and/or role.

9 . The computer-implemented method of claim 6 , wherein corresponding protection levels are set for the multiple data domains.

10 . A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform one or more operations for zero-trust security container data control, comprising:

generating a zero-trust security policy based on a scenario;

building a data pool for a zero-trust security container;

adopting the zero-trust security policy for data to be admitted to or egressed from the data pool and while within the data pool, wherein admission or egress is allowed for the data to be in or out of the data pool only after the data is verified based on the zero-trust security policy; and

hierarchically isolating data in the data pool based on the zero-trust security policy and so that the data in the data pool can be read directionally, wherein isolating the data in the data pool includes limiting upper limits of resources that can be used by a process group, and wherein course-grained and fine-grained control is performed on the data in the data pool from different dimensions comprising one or more of a data source, a role of a data writing party, and a role of a data reading party,

wherein at a coarse-grained level, access control is performed on a data stream between servers,

wherein at a fine-grained level, data access is restricted based on one or more of a role, an identity, or a source, and

wherein each piece of data in the data pool has a role label and a source label, and data with different role labels and source labels are mutually isolated.

11 . The non-transitory, computer-readable medium of claim 10 , wherein the zero-trust security policy comprises trusting none of data reading/writing parties.

12 . The non-transitory, computer-readable medium of claim 11 , wherein the zero-trust security policy comprises:

verifying a source for data to be written to the data pool; and

admitting, as admitted data, data whose source is verified, wherein the admitted data is labeled with a source label.

13 . The non-transitory, computer-readable medium of claim 11 , wherein the zero-trust security policy comprises:

verifying a source and a role of a data writing party for data to be written to the data pool; and

admitting, as admitted data, data whose source and role of a data writing party are verified, wherein the admitted data is labeled with a source label and a role label of the data writing party.

14 . The non-transitory, computer-readable medium of claim 12 , wherein the zero-trust security policy comprises:

verifying, for data to be read from the data pool, a source, a role of a data writing party, and a role of a data reading party that are provided by the data reading party; and

egressing data whose source, role of a data writing party, and role of a data reading party are verified.

15 . The non-transitory, computer-readable medium of claim 10 , wherein the hierarchically isolating data in the data pool based on the zero-trust security policy comprises isolating the data pool into multiple data domains.

16 . The non-transitory, computer-readable medium of claim 15 , wherein isolating the data pool into multiple data domains comprises isolating the data into the multiple data domains by sensitive data and runtime data.

17 . The non-transitory, computer-readable medium of claim 15 , wherein isolating the data pool into multiple data domains comprises isolating the data into the multiple data domains by source and/or role.

18 . The non-transitory, computer-readable medium of claim 15 , wherein corresponding protection levels are set for the multiple data domains.

19 . A computer-implemented system, comprising:

one or more computers; and

one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations for zero-trust security container data control, comprising:

generating a zero-trust security policy based on a scenario;

building a data pool for a zero-trust security container;

adopting the zero-trust security policy for data to be admitted to or egressed from the data pool and while within the data pool, wherein admission or egress is allowed for the data to be in or out of the data pool only after the data is verified based on the zero-trust security policy; and

hierarchically isolating data in the data pool based on the zero-trust security policy and so that the data in the data pool can be read directionally, wherein isolating the data in the data pool includes limiting upper limits of resources that can be used by a process group, and wherein course-grained and fine-grained control is performed on the data in the data pool from different dimensions comprising one or more of a data source, a role of a data writing party, and a role of a data reading party,

wherein at a coarse-grained level, access control is performed on a data stream between servers,

wherein at a fine-grained level, data access is restricted based on one or more of a role, an identity, or a source, and

wherein each piece of data in the data pool has a role label and a source label, and data with different role labels and source labels are mutually isolated.

20 . The computer-implemented system of claim 19 , wherein the zero-trust security policy comprises trusting none of data reading/writing parties.